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Abstract 

We establish the first hardness results for the problem of computing the value of one-round games 
played by a verifier and a team of provers who can share quantum entanglement. In particular, we show 
that it is NP-hard to approximate within an inverse polynomial the value of a one-round game with (i) 
quantum verifier and two entangled provers or (ii) classical verifier and three entangled provers. Previ- 
ously it was not even known if computing the value exactly is NP-hard. We also describe a mathematical 
conjecture, which, if true, would imply hardness of approximation to within a constant. 

We start our proof by describing two ways to modify classical multi-prover games to make them 
resistant to entangled provers. We then show that a strategy for the modified game that uses entanglement 
can be "rounded" to one that does not. The results then follow from classical inapproximability bounds. 
Our work implies that, unless P = NP, the values of entangled-prover games cannot be computed by 
semidefinite programs that are polynomial in the size of the verifier's system, a method that has been 
successful for more restricted quantum games. 
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1 Introduction 



Multi-prover games have played a tremendous role in theoretical computer science over the last two decades. 
In this setting, several provers, who are not allowed to communicate with each other during the game, 
exchange messages with a verifier according to a prescribed protocol and try to convince him to accept. 
The value of a game is the maximum probability with which the provers can achieve this, averaged over all 
the verifier's questions and possibly over the shared randomness of the provers. The Cook-Levin Theorem 
implies that it is NP-complete to compute the value of such a game, where the input is an explicit description 
of the game, i.e., a set of possible questions, possible answers, a distribution on questions and acceptance 
predicates for the verifier. A lot of research effort went into determining how hard it is to approximate 
the value of such games, culminating in the celebrated PCP Theorem iALM"'"98l IAS98II . which shows 
that the value of a two-prover one-round game with a constant number of possible answers is NP-hard to 
approximate to within some constant. This result has had wide-ranging applications, most notably in the 
field of hardness of approximation, where it is the basis of many optimal results. 

When considering multi-prover games in the quantum world, the laws of quantum mechanics allow 
for a fascinating new effect: namely, the provers can share an arbitrary entangled state, on which they 
may perform any local measurements they like to help them answer the verifier's questions. The fact that 
entanglement can cause non-classical correlations is a familiar idea in quantum physics, introduced in a 
seminal 1964 paper by Bell IBel64.|. Most importantly, there is no physical way to prevent provers from 
sharing entanglement or to limit how much they have. Compare this to the restriction that the provers cannot 
communicate during the game, which can be enforced physically by separating the provers in space so that 
there is no time for a message to travel from one to the other. It is thus a natural and important question 
to ask how shared entanglement between the provers influences the value of the game, as entanglement can 
allow for new strategies of the provers. Notice that entanglement can potentially either make it easier or 
harder to approximate the value of a game, and it is a wide open question which of these two effects actually 
takes place. For example, no algorithm — of any complexity at all — is known to approximate the value of an 
arbitrary entangled-prover game. One of the most important questions in this field, which we answer in this 
paper, has been to determine if it is hard or easy to compute the value of entangled-prover games. 

Two recent results give evidence that entangled-prover games might actually be computationally much 
easier than their classical counterparts. First, Cleve et al. fCHTW04| showed that in the case of a particular 
class of two-prover one-round games, XOR-games, the value when provers are entangled can be computed 
(to exponential precision) in polynomial time. In contrast, Hastad llHasOlll showed that for these games 
without entanglement it is NP-hard to approximate the value to within some constant. To prove their result, 
Cleve et al. show that the maximization problem of the two provers can be written as a semidefinite program 
(SDP) of polynomial size. It is well known that there are polynomial time algorithms to find the optimum of 
such SDPs up to exponential precision, and hence there is a polynomial time algorithm to compute the value 
of this game. More precisely, Cleve et al. show that there is an SDP relaxation for the value of the game 
with the property that its solution can be translated back into a protocol of the provers. This is possible using 
an inner-product preserving embedding of vectors into two-outcome observables due to Tsirelson IITsi87ll . 
which works in the particular case of XOR-games. It has been a major open question whether this result 
generalizes beyond XOR-games. 

In a second recent result giving evidence that entangled-prover games are easy, Kempe, Regev and 
Toner [iKRT07.l show that even for the class of unique games (which contains the class of XOR-games), an 
SDP-relaxation of the game gives a good approximation to its value. Hence, for unique games there is a 
polynomial time algorithm to approximate the value of the game to within a constant. 

An SDP-relaxation is not specific to XOR-games or unique games and can be written for all entangled 
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two-prover games 



If the SDP is tight (as in the case of XOR-games) or close to tight (as in the case of 



unique games) there is a polynomial time algorithm to compute or approximate the value of the game. It 
was speculated that perhaps SDPs can compute or at least approximate well the value of an entangled game 
for more general games. The semidefinite programming approach has been widely successful whenever 
quantum communication is involved: for example Kitaev and Watrous BKWOOII have shown that SDPs can 
exactly compute the value of single-prnver quantum games, Gutoski and Watrous proved that the value of 
quantum refereed games is as hard to compute as the value of classical refereed games again via semidefinite 
programming [GW07], and Kitaev showed that the cheating probability for quantum coin-flipping protocols 
MKitl can be computed by SDPs. Moreover, Navascues et al. IINPA07I recently gave a hierarchy of SDP 
relaxations to approximate the value of an entangled two-prover game; yet no bounds on the quality of 
approximation have been proved and these SDPs are in general not of polynomial size. 

The major open question is thus to determine if it is easy or hard to compute or even to approximate the 
value of general entangled-prover games. In particular, would it be possible that the value of such games 
could be computed or approximated by an SDP? 

Our results. In this paper we resolve the open question above by showing for the first time that it is NP- 
hard to compute the value of entangled multi-prover games in the quantum world. We need to distinguish 
between two types of entangled games: on one hand one can still restrict the (possibly entangled) provers 
to classical communication; we call such games classical entangled games. On the other hand one can also 
allow the provers to communicate quantum messages with a quantum verifier, we call these games quantum 
entangled games. In both cases the hardness of computing the value of the game with entangled provers 
was previously not knownH and we show NP-hardness in two cases: for two-prover one-round quantum 
entangled games (in the first part of the paper) and for three-prover one-round classical entangled games (in 
the second part). Then we proceed to show that even approximating the value of these two types of games is 
NP-hard, thus giving the first hardness of approximation resultsJl Our main result can be stated as follows: 

Theorem 1. There exists a polynomial p such that it is NF-hard to decide, for an explicitly given 

1. two prover one-round quantum entangled game G or 

2. three prover one-round classical entangled game G, 



This theorem implies that no polynomial-time algorithm can compute the value of an entangled game 
to within polynomial precision. Given the importance of SDPs in results on entangled games, the following 
immediate corollary is of interest: 

Corollary 2. The success probability of classical entangled 3-prover or quantum entangled 2-prover games 
cannot be computed by SDPs of polynomial size, unless P = NP. 

The results above leave open the case of fwo-prover one-round classical entangled games. In the third 
part of this paper we give a hardness result for this type of game which is stated precisely in Section[5]in the 
setting of succinct games and interactive proofs; here we just give a brief overview. This third result has a 

'in particular it will also be a relaxation for the value of the classical game (which is not tight in this case, unless P — NP). 

^Kobayashi and Matsumoto | KM03 1 showed that when the communication and the verifier are quantum, but the provers do 
not share any entanglement, then the resulting games behave like classical games without entanglement, i.e., it is NP-hard to 
approximate their value to within a constant. 

''Obviously the hardness of computation result is implied by the hardness of approximation result. We include it nonetheless in 
Sec. l3.1l for the quantum entangled games to illustrate the main ideas. 

''See Section|2]for a precise definition of the size \G\ of G. 



whether its value is lorl — 
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slightly different flavor: we scale up to games with exponential number of questions and answers, but given 
succinctly (i.e. the game is given by a description of the circuit of the verifier of size polynomial in log \ Q\, 
the length of the questions). For these games we show that to approximate the value to within an inverse 
polynomial (in log |(5|) is at least as hard as to approximate to within a constant the value of classical single- 
prover multi-round games with polynomial rounds. Note that this is a better approximation than in the first 
two results of our paper (where the approximation was an inverse polynomial in |Q|), but our hardness in 
this case is weaker than in the previous two results. In particular, combining this with an adapted version of 
Shamir's result [Sha921 that IP = PSPACE, our result implies PSPACEC MIP*(2, l)i^i_poiy-i- Again, 
no such result was previously known for these games. 

All three results turn out to have something in common — in the analysis of all three of them we show 
that by enforcing certain tests we obtain sets of projectors (which characterize the strategy of the provers) 
which pairwise "almost commute" . From this condition we need to derive a classical strategy for the original 
classical game, and we do this in a similar fashion in all three cases. 

Proof ideas and new techniques. 

Reduction: We prove our NP-hardness results by a reduction from the hardness of approximation 
result for classical (non-entangled) games, as implied by the PCP Theorem, which we state in the language 
of games: 

Theorem (PCP Theorem iALM"'"98l IAS98II ). There is a constant s < \ such that it is NP-hard to decide, 
given a two-prover one-round game with a constant number of answers, whether its value is \ or < s. 

We start with an instance of such a classical two-prover one-round game and modify it to a two-prover 
one-round quantum entangled game (or a three-prover classical entangled game, in the second part of this 
paper) with the property that the value of the new entangled game is at least as big as the value of the original 
game. In other words, if the value of the original game is 1, the value of the new game is still 1. To show that 
it is NP-hard to compute the value of the entangled game we need to show that if the value of the original 
game is below s then the value of the new entangled game is smaller than 1. In particular, it suffices to 
show that if the value of the new entangled game is 1, then the value of the original game is also 1. To show 
this, we use a successful strategy of the entangled provers to construct a strategy in the original game that 
achieves a large value (see Rounding below). 

Because we only need to show this when the new value is exactly 1 our task is fairly easy once we 
have established how to modify the game. It requires substantially more work to prove the hardness of 
approximation result. We perform the same reduction as in the exact case, but now we need to show that if 
the value of the original game is at most s, then the value of the new entangled game is bounded away from 
1 by an inverse polynomial. Equivalently, we have to show that if the value of the new entangled game is 
above 1 — e for some inverse polynomially small e, then the value of the original classical game is larger 
than s. 

Modify the game to "immunize" against entanglement: An essential novel technique in our paper 
is the design of the new games used in our reduction. We design the new games in a way that limits the 
cheating power of entangled provers. To this end — and this is a crucial difference to previous attempts to 
upper bound the value of entangled games — we add an extra test to the game. This new test, which can 
be added generically to any two-prover one-round game, significantly limits the use of entanglement by the 
provers beyond its quality as shared randomness. We hope that this technique of "immunizing" a game 
against entanglement can be extracted to serve a wider purpose in other contexts where we want to Umit the 
power of entanglement, possibly with cryptographic applications. 

In hindsight the fact that we need to modify the games comes as no surprise. Several classical games 
have been analyzed in the past to show that without modification of the game, entanglement drastically 
increases their value. One striking example is given by the Magic Square game l,Ara02,l : Two classical 
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players can win this game with probability at most 17/18. However, when given entanglement, the players 
can win perfectly, i.e., they have a strategy that wins with probability 1. 

Our next novel element is the actual design of the new test. The difficulty is to show that entangle- 
ment does not help the provers to coordinate their replies to increase the success probability. In the case of 
quantum games (in the first part of this paper) our idea is to astutely use quantum messages and quantum 
tests, and in particular a version of the SWAP-test, to enforce (approximately) that the provers do not en- 
tangle the message register with the entangled state they share. This allows us to get conditions that involve 
the provers' operators (describing their strategies) on two different questions. For this it is crucial that the 
messages are quantum; we do not see any way to achieve this result for classical messages. 

When we analyze classical entangled games (in the second part of our paper) we design a different test: 
we modify the game by introducing a third player. We use the extra player to introduce a consistency test 
that forces two of the provers to give the same answer. As a result, to pass this test, the two original players 
can only use an entangled state of a specific form; it must be (approximately) extendable, i.e., it must be the 
density matrix of a symmetric tripartite state. There are prior results pointing to the potential usefulness of 
a third player to limit the cheating power of entanglement. For example, two entangled provers can cheat in 
the Odd Cycle game of Ref. [CHTW04], but if we add a third prover, then entangled provers can perform 
no better than classical ones IITon06ll . Moreover, after the completion of this work we have learned from 
A. Yao BYaol about a way to add a third player to the Magic Square game such that as a result the winning 
probability of entangled provers is f« 0.94. 

For our third result on two-prover classical entangled games, our reduction has the same spirit and similar 
analysis as in the previous two cases: here we start with a single-^xovtr multi-round game and modify it 
to a one-round game by introducing a second prover to prevent the first prover to entangle the answers of 
subsequent rounds. Our modification here mimics a construction of [|CCL94| used to prove that PSPACE 
has (non-entangled) two-prover one-round systemsH 

Rounding: The extra quantum test (resp., the extra player) allows us to extract a mathematical condition 
on the operations of the entangled players. More precisely it turns out that the projectors corresponding to 
the various questions of the verifier pairwise "almost commute" in some sense or "almost do not disturb" 
the entangled state. This means that the provers' actions are "almost classical", in the sense that they allow 
us to take any strategy in the entangled game and convert it back to a strategy in the original classical game. 
We call this conversion rounding from a quantum solution to a classical solution, in analogy to the rounding 
schemes used to convert a solution to an SDP relaxation to a solution of the game. To explain the idea of 
our new rounding scheme, assume that the provers, when receiving a question from the verifier, perform a 
projective measurement on their share of the entangled state depending on the question, and answer with 
the outcome they get (it will turn out that this is essentially what the provers can do, even when the game 
involves quantum communication). In the exact case, when the value of the entangled quantum game is 1, 
the measurements corresponding to different questions commute exactly. Hence, there is a common basis in 
which the projectors corresponding to different answers are all diagonal for all questions. In other words, 
for each question, the projectors simply define a partition of the basis vectors. The probability that the 
provers give a certain pair of answers just corresponds to the size of the overlap of the supports of the two 
corresponding projectors, i.e., to the number of basis vectors that are contained in both of them. We can now 
construct a classical strategy for the original game, where the provers use shared randomness to sample a 
basis vector, check which projector/partition contains it, and output the corresponding answer. This classical 
strategy achieves exactly the same probability distribution on the answers, and hence the same value of the 
game. 

Matters complicate in the case where the value of the entangled game is 1 — e. Now, the provers' mea- 

^In fact, we show that the ICCL94I construction still remains sound even with entangled provers, albeit with a weaker soundness 
than in the classical case. 
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surements corresponding to different questions "almost commute". To exploit this property in a rounding 
scheme, imagine the following pre-processing step to eliminate entanglement from the strategy: Before the 
game starts, the provers apply in sequence all possible measurements, corresponding to all possible ques- 
tions, on a share of the entangled state, and write down a list of all the answers they obtainU Then, during the 
game, when they receive a question from the verifier, they respond with the corresponding answer in their 
list. Because the measurements almost commute, the answer to any one particular question in this sequen- 
tial measurement scheme are similarly distributed to the scenario in the entangled game, where the prover 
only performs the one measurement corresponding to that question. This can be seen by "commuting" the 
corresponding projectors through the list of projectors in the measurement, where each time we commute 
two operators we loose an e in precision. As a result, also the success probability of this new unentangled 
strategy is similar to the one in the entangled game, or at least not too low. 

A new mathematical challenge: As mentioned above, our tests enforce an almost-commuting condition 
on the operators of the provers. If they would commute exactly, they would be diagonal in a common basis, 
which means that the strategy is essentially classical and does not use entanglement. If one could conclude 
that the operators are nearly diagonal in some basis, one could again extract a classical strategy as in the 
exact case. Hence we reduce proving constant hardness of approximation to the question whether one can 
approximate our operators by commuting ones. This touches upon a deep question in operator algebra: Do 
almost commuting matrices nearly commute? Here almost commuting means that the commutator is small 
in some norm, and nearly commuting means that the matrices can be approximated by matrices that are 
diagonal in some common basis. This famous question was asked for two Hennitian matrices by Halmos 
back in 1976 IIHal76ll FI It was shown subsequently using methods from algebraic topology, that 

this conjecture is false for two unitary matrices. Then, Halmos' conjecture was disproved in the case of 
three Hermitian matrices. Finally Halmos' conjecture was proved ||Lin97ll by a "long tortuous argument" 
HDSOll using von Neumann algebras, almost 20 years after the conjecture had been publicized. In our case 
we reduce proving hardness of approximation of the value of an entangled game to the conjecture for a set 
of pairwise almost commuting projectors, where the norm is the Frobenius norm \\A\\l = Tr(^t^) (see 
Sec.HB: 

Conjecture. Let Wi , . . . , Wn be d-dimensional projectors such that for some e > Ofor all i, j € {1, . . . ,n} 

— WjWi\\2 < e. Then there exists a 6 > 0, and pairwise commuting projectors Wi, . . . Wn such 
that - WiWl ^ 6 for alii G {1, . . . ,n}. 

Our proof shows that the conjecture with a constant 6 implies hardness of approximation of the value of 
entangled games to within a constant, i.e., best possible. For two, three or a constant number of projectors 
the conjecture is easy to prove for a constant S. We do not know if it is true in general. 

Related work. A subset of the authors has obtained weaker results on harness of approximation of the 
value of entangled two-prover quantum games, posted to the arXiv earlier IIKV06I : the present paper in- 
cludes and supersedes these results. Since this paper had been made public, our techniques have already 
been applied by ilKP+07t to show similar results for binary three-player one-round classical entangled 
games. lllKP+07l also give a new upper-bound for the value of these games; or, as often called in this 
context, they gave a new tripartite Tsirelson-inequality. After the completion of this work Cleve, Gavinsky 
and Jain [iCGJ07ll use a connection to private information retrieval schemes to show that succinctly given 
binary entangled classical games can not be approximated in polynomial time. Their result does not apply 

^Obviously, the provers do not really need any entanglement to do this: all they have to do is sample from the joint distribution 
that corresponds to the distribution of all the answers in this sequence of measurements. 
'For the operator norm. 
*For a simpler, elegant proof see IEL89I . 
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for explicitly given games, as it is based on an exponential expansion of the message length. It uses very 
different techniques, and is not comparable to ours. 

Structure: The structure of this paper is as follows: In Section|2]we introduce the necessary definitions 
and notations we use. In Section [3] we prove our results on the NP-hardness of quantum entangled two- 
prover games. To flash out the ideas, we first prove hardness of computing the value of such games, before 
showing hardness of approximation. In Section |4] we show NP-hardness of approximation for the value 
of three-prover classical entangled games, and in Section [5] we give our hardness results for two-prover 
classical entangled games. We discuss our results and open questions in Section[6] 

2 Preliminaries 

We assume basic knowledge of quantum computation IINCOOI . 

Games. In this paper we study multi-prover games, or cooperative games with imperfect information 
(henceforth games). We will only deal with one-round games played by N cooperative provers against a 
verifier. For an integer K, denote {1, . . . , K} by [K]. 

Definition 3. Let Q and A be integers. A game G = G{N, vr, V) is given by a set Q = {'7ii...ijv}{ji...ijv)6[Q] 
of questions and A = {aji...ijv}{ji...ijvl£[yl] of answers, together with a distribution vr : [Q]^ — > [0, 1], and 
a function V : [A]^ x [Q]^ {0, IjJl The value of the game i^ 

Lo{G) = sup ^ 7r(zi, . . . ,iAr) ^ Fr{aj^...jj^)V{aj^...jJii---iN), (1) 

where the Wi are the prover's strategies, and the probability Vv[aj^...j^) = Pr(VFi(ii, r) • • • WN{iN-,f) = 
•^ii - iiv) taken over the randomness of the provers. 

The game G is played as follows: The verifier samples ii, . . . from [Q]^ according to vr, and 
prepares a question qi^...i^ G Q. He sends the A;-th part of the question to prover k for 1 < k < N and 
receives the answer aj-^...jj^ G A from the provers. The provers win the game if y(aj^...j^|zi • • • iiv) = 1; 
otherwise the verifier wins. The value of a game is the maximum winning probability of the provers. The 
provers can agree on a strategy before the game starts, but are not permitted to communicate after receiving 
questions. 

We distinguish three different kinds of games, based on the classical or quantum nature of the verifier, 
the provers, and the question and answer sets. A game G will be called 

• classical if the verifier, the prover, and the question and answer sets are classical. In this case qi^-ij^ = 
[qi, . . . , q^) and ai^...i^ = (oi, . . . , qat) are A^-tuples, i.e., the verifier simply sends q^^ to the k-tYi 
prover and receives au from him. We identify Q with [Q]^ , A with [A\^ , with q^, and jk with 
and often write Q for [Q] and A for [A\. The strategies Wi are simply functions Wi : Q x R ^ A 
where R is some arbitrary domain ("shared randomness"). In fact we can assume the strategies to be 
deterministic: there is always some r ^ R that maximizes the winning probability and we can fix it in 
advance. 

• classical entangled if the verifier, and the question and answer sets are classical, but the provers 
are quantum, and are allowed to share an a priori entangled state | of arbitrary dimension. This 

'We write V{-, ■) as V^( | ) to clarify the role of the inputs. 

'"We use a supremum because the optimal strategies might not be finite in the case of entangled provers. 
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increases the set of possible strategies to quantum operations performed on the prover's share of the 
entangled state. By standard purification techniques (see, e.g, IICHTW04i ) one can assume that each 
prover performs a projective measurement Wq = {WI^}aeA with outcomes in A (i.e., J2aeA ~ 
Id and (Wg")t = W^" = {W^^f), where we adopt the same notational identifications as for classical 
games. We will use a superscript * to indicate entangled-prover games. The value uJ*{G) of such a 
game is given by Eq. © where the probability Pr(ai ldots,aN) = {^\iWi)gl O • • • {WN)q^\^)- 

• quantum entangled if both the verifier and the provers are quantum, and they exchange quantum 
messages. We usually denote such a game by Gq. In that case qi^.-i^ G Q is a joint density matrix 
and the verifier sends its k-th part to the k-th prover for 1 < k < N using a quantum channel, 
possibly keeping a part in his own private register. After receiving as answer an A^-register quantum 
state CLj^.-.j^ G A, where the k-th prover sends the fc-th register, the verifier performs a quantum 
operation V' (which might depend on the questions in [Q]^) on the answer and his private space, 
followed by a measurement {liacc^^rej} of his first qubit. By purification we can assume that the 
fcth prover performs a unitary transformation Uk on the message register and his part of the entangled 
state I'l') and then sends the message register back to the verifier. The value of an entangled-prover 
quantum game, lij* , is given by Eq. ([T) where 

^ Vr{aj^...j^)V{aj^...jJh ■■■iN)= Tv{IlaccV' {Ui (d ■ ■ ■ ® UN){qh-i^ 



Input size. A game is described by Q,A,tt and V, and hence our complexity parameter, the size of the 
input, is polynomial in Q and A\!_j We will always assume that the description of the distribution vr is 
of polynomial size in Q. In the case of quantum games we also have to take into account the size of a 
description of the question qi^,,,ij^, and the verification procedure V', and the dimension of the answer 
'^3i-3n'- always assume that the dimensions of qi-^.,.ijs, and aj^^^jj^ are polynomial in Q and A and hence 
there is a (classical) description of qii.-^, and of V (which can be assumed to be a unitary of polynomial 
dimension) of polynomial size in Q, Ar^ 



Symmetric games. For convenience we will work with symmetric distributions vr. The next lemma shows 
why this poses no restriction (we only need the case of 2 provers). 

Lemma 4. For every game G = G{2, vr, V) there is a game G' = G{2, vr', V) of the same value and twice 
as many questions, such that it' and V' are symmetric under permutation of variables. Moreover there is an 
optimal symmetric strategy for G'. 

Proof. The verifier V in game G' samples q, q' from vr. He adds an extra bit register to the questions and 
with probability 1/2 he sends {q, 1) to prover 1 and (g', 2) to prover 2, otherwise he swaps the two questions. 
In the second case he swaps the received answers and in both cases applies the predicate V. For the lower 
bound observe that if 5i , 52 is a strategy for G, then the strategy for G' where each prover applies Si if his 
second message bit is i fares as well as 5i, 52 (and is symmetric). For the upper bound note that from any 
strategy Sa,Sb for G' we can construct a strategy for G that fares at least as well, by choosing the better 
of either 5yi(-, 1), 5b(-, 2) or 5b(-, 1), 5a(-, 2). Moreover, V' is obviously symmetric under permutation of 
question-answer pairs. □ 

In the case where the provers are allowed to share entanglement, we can assume that if vr and V have some 
symmetry, it is mirrored in the optimal prover's strategies: 

"Here we always assume that is a constant. 

'^In fact all games we consider also have a circuit of size poly log Q to prepare qi^...i,si f™m ii, . . . , ijv. 
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Lemma 5. Let G = G{N, Tr,V) bea (classical or quantum) entangled-prover game, such that'7r{ii, . . . ,i]\f) 
is symmetric in ii, . . . ,ik and V is symmetric under simultaneous permutation of the registers 1 ... A; of the 
questions qi-^—if^ and of the answers ai-^^.-i^ for k < N. Then given any strategy Pi, ... , P/v with entan- 
gled state \ ^) that wins with probability p, there exists a strategy P[, . . . , P'j^ with entangled state \ ^') and 
winning probability p such that P[ = . . . = Pj^ and \ ^') is symmetric with respect to the provers 1, . . . ,k. 

Proof. Let 6k be the set of permutations of {1, ... , k} and assume, by appropriately padding with extra 
qubits, that the first k registers of l^*) have the same dimension. Define strategies P[, . . . , as follows: 
the provers share the entangled state |^') = J^aeGk I'^i'^)) • • • I'^i^)) "X" |^'^)> where the register containing 
\a{i)) is given to prover i and l^*"^) is obtained from |^) by swapping the first k registers according to a. For 
i < k prover i measures the register containing and applies Pcr(i)- For i > k, P[ = Pi. By symmetry 

of TT and V this new strategy achieves the same winning probability p, and j'l'') has the required symmetry 
properties. □ 



3 Hardness of two-prover entangled quantum games 

In this section we prove Theorem[T]for the case of two-prover quantum entangled games. To better quantify 
the dependence on the input size, we restate it as a separate result: 

Theorem 6. There is a constant Sq > such that it is NP-hard to decide, given an two-prover quantum 
entangled game, whether its value is 1 or less than 1 — efor e = 

As mentioned in the introduction, we will prove this by a reduction from the PCP Theorem. However, 
to more clearly and cleanly expose the ideas in this proof, we will first prove the simpler statement about 
NP-hardness of computing the value. 



3.1 NP-hardness of computing the value of entangled quantum games 

Theorem 7. It is NP-hard to decide, given an two-prover quantum entangled game, whether its value is 1. 

We first describe how to modify a two-prover classical game Gc(2, n, V) with questions Q and answers 
A to a two-prover quantum game of equal or higher value. We assume that the distribution 7r{q, q') is 
symmetric (as per Lemma |4l at the expense of doubling the number of questions) and also that there is a 
non-zero probability for each question to be asked (otherwise we remove it from Q without affecting the 
value of the game). 



The modified quantum game. In the constructed quantum game Gq the verifier sends quantum registers 
|g, 0)a and \q' ,Q)b to provers A and B. We call the first part of this register the question register and the 
second part the answer register. The answer register is initially in some designated state 1 0) and the provers 
are expected to write the answers a G ^ to the question q ^ Q into this register and then send both registers 
back. The verifier performs one of two tests, with equal probability: 

Classical Test: The verifier samples (q, q') according to the distribution 7r{q, q'), and sends \q, 0) to prover 
A and \q' , 0) to prover B. Upon receiving these registers from the provers, he measures them and accepts 
if the results of the measurement of the question registers is g, q' and the results of the measurement of the 
answer registers a, a' would win the game Gc. 

Quantum Test: The verifier samples {q,q') according to the distribution TT{q)7r{q'), where 7r{q) is the 
marginal of 7r(g, q') and prepares the state 

(|0)k,0)A|g',0)B + \l)\q',0)A\q,0)B) • (2) 
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He keeps the first qubit and sends question and answer registers to provers A and B. Upon receiving tliese 
registers from the provers, he performs a controlled-SWAP on registers A and B conditioned on the first 
qubit being |1) (he swaps both the question and the answer register). Then he measures his qubit in the 
basis {|+), |— )]oand the question registers. He accepts iff the results of the measurement of the question 
registers is q, q' and the outcome of the measurement of the first qubit is "+". 

Remarks: Note that the value uj*{Gq) of the constructed game Gq is obviously at least the value of 
Gc- If the entangled quantum provers, controlled on the question, simply write the answer that the classical 
unentangled provers would have given into the answer register, they always pass the quantum test, and hence 
u;{Gq) > uj{G,)/2 + 1/2 > uj{G,). 

Moreover the description of the quantum game has essentially the same size as the description of the 
classical game, i.e. the complexity parameter is the same in both cases. The dimension of question and 
answer registers is |(5| and \A\ and the SWAP test only requires extra space that is no more than linear in 
the number of qubits swapped. 

Note that it is only the SWAP-test that is genuinely quantum, and allows us to show that the provers 
cannot entangle too much the questions they receive with the entangled state they share, by relating their 
actions on two different messages. This test has been used in various settings in the past. In its most simple 
form it was used in MBCWdWOlll to give a protocol for quantum fingerprinting. However, the test that we 
perform here is a little more sophisticated, since it implements only a partial SWAP on the two message 
registers, which might be entangled with the prover's private spaces and entanglement, on which the verifier 
in unable to perform the swapping. This partial swap has been used in |KWOO] to show parallelization for 
QIP, and in IIKMY03I to prove the inclusion QMA(3) CQMA(2), where the 2 and 3 refer to the number of 
Merlins. 

A last remark concerns the two different probability distributions used in the two tests. We really need 
to change the distribution in the quantum test, because it gives us a commutation condition for all operators 
of the provers, corresponding to all different questions. Otherwise, we would only obtain it for pairs of 
questions q, q' corresponding to a non-zero 7r(g, q'), which is not sufficient to round to a classical strategy. 

Existence of a good classical strategy. We now show that if the value of the quantum game is 1, then 
there is a strategy for the classical game that wins with probability 1. 

Lemma 8. Ifuj*{Gq) = 1 then uj{Gc) = 1. 

This implies that if the value of the classical game was less than 1, then the value of the quantum game 
is less than 1. Since it is NP-hard to distinguish whether the value of the classical game is 1 or not, it follows 
that it is NP-hard to decide whether the value of the quantum game is 1. 

Proof of Lemma ^ Consider a maximizing strategy, which in particular passes the quantum test with cer- 
taintyLj Note that if it were not for the controlled-SWAP the game would be essentially an entangled 
classical game, because question and answer registers are prepared in a classical state and are immediately 
measured when received by the verifier. We first show that the strategy of the provers is indeed essentially a 
classical entangled strategy. 

Claim 9. There is a shared bipartite state \ '^)ab and for each question q ^ Q a set of projectors {Wq}a<^A 
acting on each prover's half of \^) with X^asA ~ such that each provers' transformation can be 

'^Or, equivalently, he performs a Hadamard transform and measures his qubit in the standard basis. 

''^Strictly speaking it could be that such a strategy exists only in the limit of infinite entanglement, so we would have to use a 
strategy that achieves success probability arbitrarily close to 1. Since in this part we only give the ideas of the rigorous proof in 
Section [X2I we ignore this issue. 
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written as \q)\0)\^) \q) |a)W^|^') and the probability that the verifier measures a, a' in the answer 
registers given he sampled q, q' in the classical test is 

Pg{a,a'\q,q') = ||%" T^;,>)ABf • 

Proof. At the beginning of the protocol the provers share some entangled state l^'') (including their private 
workspace). From Lemma |5] we can assume that the strategies in the quantum game are symmetric, i.e., 
that A and B apply the same unitary transformation U. Since the provers pass the quantum test perfectly 
it means that they do not change the question register. Hence it is easy to see that U is block-diagonal and 
can be written as [/ = J2q \q){q\ ^ where Uq acts on the answer register and half of \^'). Define the 
operators = (a|C/q|0), where |0) and \a) only act on the answer register, not on l^''), i.e. C/g|0)|^'') = 
|a)W^|^''). Then it follows that X]a(^g ~ meaning that are superoperators acting on a 

part of 1^''). By standard arguments we can now enlarge the system to a state \'^) such that we can replace 
the Wq by projectors which give exactly the same outcome probabilities. □ 

We now derive the crucial condition that allows us to define a good classical strategy. 
Claim 10. 

Vg, g', a, a' W^' I ^) = W^' ^W^\^). 

Proof. After the controlled-SWAP and the measurement of the question registers as q,q', the remaining 
state of the entire system can be described as 

a,a' 
a,a' 

and hence the probabihty to measure "— " in the extra qubit is \ ^, ||(Wg ® W^, — W^, ® VF^)|^') |p 
which must be since the provers pass the quantum test with certainty. □ 

Rounding: This property of the projectors can be expressed in a different fashion. Assume for simplicity 
that the shared state is maximally entangled, i.e., \^) = X^^Li and that all projectors are real. 

Then for any such projectors W,W' we have \\W ® W'\^)f' = \\\W^'Vf^ where = Tr(At^) 

is the Frobenius norm. The condition in Claim [TO] can be rewritten as — = 0, i.e. 

the two projectors commute. Hence, in some basis {|ei)}f^^, all are diagonal matrices with only 1 
and on the diagonal. In other words, each projector simply defines a partition of the basis vectors, and 
v{ad\q(l) = ^W^g^q' IIf j^^"^ measures the relative overlap of the two partitions. With this in mind we 
can easily design a classical randomized strategy for Gc with the same success probability. The provers 
sample a shared random number i € {1, . . . ,d}. When receiving question q they answer with a such that 
the basis vector |ej) is in the support of Wg. 

This proof can be generalized to an arbitrary shared state \"^) and general projectors. We will not give 
the full details (in any case Thm. |7] follows from Thm. O, but the way to prove this is to define a diagonal 
real positive matrix D with the Schmidt-coefficients of 1^*) in the diagonal. Then \\W W'\"^)\\'^ = 
WWDW'^W'jp, where the elements on the diagonal of D can be thought of as weights, and the condition in 
Claim [To] becomes \\W^D{W;^!f - W;^,' D{W^f\\F = 0. Moreover, following the same ideas as used 
in Claim[l4]to show Eq. (l3bl ). we obtain ||VF^-D — D{Wg)'^\\F = 0. Together these conditions imply 
WgW^'D = W^'WgD, i.e. the two projectors commute over the space where D is non-zero. The classical 
strategy is now a weighted version of the strategy outlined in the case of a maximally entangled shared 
state. □ 
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3.2 NP-hardness of approximating the value of entangled quantum games 



With the intuitions obtained so far we can now tackle the harder case of hardness of approximation. First a 
quick overview. We modify the game in exactly the same way as before. To prove Theorem |6] we now need 
to show, for s from the PCP Theorem: 

Lemma 11. lfoj*{Gq) > I - e then uj{Gc) > s. 

This implies that if the value of the classical game was less than s, then the value of the quantum game is 
less than 1 — e. Since, from the PCP Theorem it is NP-hard to distinguish whether the value of the classical 
game is 1 or less than s, it follows that it is NP-hard to decide whether the value of the entangled quantum 
game is 1 or below 1 — e. 

To prove Lemma [TH we first show that the strategies of the provers are essentially projective measure- 
ments (Claim [T2I ). We then extract the "almost commuting" conditions on the operators of the provers 
(Claim [T4l). which allow us to give a good strategy for the original game. 

Proof of Lemma\T7\ Consider a maximizing strategylll It must pass each of the two tests with probability 
at least 1 — 2e. Again it is (approximately) true that the strategy of the provers is essentially an entangled 
classical strategy. 

Claim 12. There is a shared bipartite state \ ^)ab and for each question q £ Q aset of projectors {Wg}aeA 
acting on each prover's half of \^) with X^^gy^ = Id such that if we replace each prover's transforma- 
tion by \q)\Q)\^) \q) \ a)Wq\^) then the probability to pass each of the tests is at least 1 — 6e and 
the probability distribution on the answers in the classical test is given by 

Pg{aa'\qq') = \\W^ (S) W^! \<f)f . 

Proof. As in the proof of Claim |9] the provers apply the same unitary transformation U, which now is not 
exactly block-diagonal, but in general can be written as [/ = -^q \ q){q\ ® Uqg. Because the verifier in 
both the classical and the quantum test measures q, q' in the answer register with probability at least 1 — 2e, 
this implies that 



J2 J2 \\Uqq^Uq>q>\0)A\0)B\'^')AB\ 



< 2e, 



for both when {q,q') is sampled according to 7^{q,q') (from the classical test) or according to 'K{q)iT{q') 
(from the quantum test), where we have used symmetry of l^*') for ||--ij(|0)[/gg Uqiqi + \l)Uqiqi 

UqqmA\^)BmAB\? = \\Uqq®Uq'q'\^)A\^)BW)AB\?. 

We approximate [/ by a block-diagonal unitary operator Ojj as follows: extend each prover's private 
space by registers A' and B' of dimension |Q| + 1, initialized to |0)^' and |0) b' and let Ojj = \q) {q\ ^Tq, 
where the unitary matrix Tq acts on half of the entangled state and the answer register (together shortened 
as |-)) and A' as 

r,|.)|0)^. = Uqq\-)\0)A'+Y.Uqq\-)\q)A' 

and is extended to a unitary matrix on the other states \q)A'- Observe that 



'^Since it could be that the value of the game is only achieved in the limit of infinite entanglement we in fact consider a strategy 
with finite entanglement that has success probability 1 — e — 5 for some arbitrarily small S. We will not write this S in what follows, 
but the proof goes through for small enough 5, for instance 5 — 0{e). 
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E(q,90 [II {Ou ®Ou-{U® Id A') ®{U® IdB')) k, 0)Ak', 0)b|^'')|0)a'|0)b' 



E 



(9,5') 



2 E ||?7,g®C/,,,H0U|0)B|^')f 



<4e, 



again for both when {q,q') is sampled according to 'K{q,q') or according to TT{q)7:{q'). This means that 
for purposes of analysis we can replace Alice and Bob's transformation U by Ou, thereby replacing the 
transformation U^U on the message registers and \ "^) by the transformation Ou(^Ou on the message space 
and 1^) = |^'')|0)a'|0)b'> at the expense of an error 4e in statistical distance on the answer probabilities 
of the classical test and the outcome probabilities in the quantum test. Since Ou is block-diagonal, the 
remainder of this claim follows exactly as in the proof of Claim |9l □ 

The SWAP-test now allows us to establish a set of inequalities which capture the "almost commuting" 
property of the operators. In what follows we will repeatedly use the following easy to verify fact. 



Fact 13. Let W^, 

vector \^). 

Claim 14. 



. , W'' be projectors such that = Id. Then X]i 11^*1^) 



I*) IP /or any 



\Q\ 

E 



E IKK; ® <^ - <^ ® K;)l^)ll' ^ 24e, 



IQI 



<Q^) E IKK; ® Id - Id ®W^^)m? < 9 • 24 • e. 



(3a) 



(3b) 



i=l 



Proof. As in the proof of Claim [TOl the left-hand side of (l3al ) is four times the probability to measure the 
first qubit in "— " in the quantum test. For (l3bl) . using Fact[T3l for any fixed qj the following holds 



\\{W^l®ld - Id 



< 



E ii(K/K^5i<^'-w2^®wvw^oi* 



E 



K;)i*) 



We can bound the square of the sum of the three norms by 3 times the sum of the norms squared, and 
summing over Oj, averaging over qi, qj, and using W;^W;^ = da,a'W^ for the second norm and Fact [T3] for 
the two others, we get three terms that are each bounded using (l3ab . concluding the proof of (l3bl) . □ 



Rounding to a classical strategy: Order the questions in Q such that 7r(gi) > 7r((/2) > ■ ■ ■ > 
Define a joint distribution on answers oi , . . . , as 

D{ai, . . . , a„) = 11(1^,'': • • • ® Umf- 

Fact [T3] shows that D is a probability distribution, J2ai a„ -^('^i' • • • i ^n) = I- 
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We can interpret the distribution D as follows: Before the game starts, the provers produce a joint list 
of answers oi, . . . , as follows: They take the first part of |^) and perform the projective measurement 
corresponding to question qi. They obtain an outcome ai, which they record. They then take the post- 
measurement state and perform on it the measurement corresponding to question q2, and so on, each time 
using the post-measurement state of one measurement as the input state of the next measurement. The 
probability that the provers record answers ai, . . . , a„ is precisely Z)(ai, . . . , a„). 

Obviously neither quantum states nor measurements are needed to implement this constructed classical 
strategy. Before the game starts, the provers simply compute D for all inputs and sample from D using their 
shared randomness. When presented with questions qi,qj they give the answer ai,aj, ignoring all other 
answers in their sample. Hence the probability to answer , aj in this case is given by the marginal of D 
with respect to Oj and aj, which we denote by Pciass{o,iaj\qiqj). 

Lemma 15. The (weighted) statistical distance between Pdass <^f^d pq is 

MPciass,Pq) = ^'^{q,q)^\Pciass{a,a\q,q) -Pq{a,a'\q,q)\ < 70- \Q\ • e^/^. 

q,q' a,a' 

Let us first show how this proves Lemma \TT\ Since the quantum strategy of the provers passes the 
classical test with probability at least 1 — Qe, this means that the classical strategy wins the original game 
with probability at least 1 — 6e — A{pciass,Pq) (where A is the dominating term), which we want to be larger 
than s. This is achieved for e = for a sufficiently small constant Sq. □ 

Proof of Lemma [75l Let qi,qj be two questions. For convenience, let us introduce the notation J2a ^'^ 
denote summing over ai, . . . , a„ and ^ to denote summing over all ai, . . . , a„ except Oj and aj. Then 
the probability of answering (oj, aj) to (qi, qj) is Pdass{aiaj\qiqj) = Ea^.j II i^q" ' ' ' ^qi ® ^ )|*) p in 
the classical strategy, and pq{ai,aj\qi, qj) = \\Wq^^ Wqj\"^) |p in the quantum strategy. We wish to bound 

^ \pclass{aiaj\q,qj)-pq{a„aj\qi,qj)\ = E I E II " " " ® ^ )|^) f - Hl^^'*; 55 <^ |^) f | . 

We now use a hybrid argument to go from the classical to the quantum probability. The point is to eliminate 
the excess in pdass with the help of Fact [131 which allows to eliminate a sum over a that involves a 
on the left side of all other operators in || • p. To get all unwanted Wq to be on the left, we move matrices 
from one register to the other whenever they are on the right, closest to l^*), at the expense of some error 
which we can bound using Eqs.©. More precisely we use the triangle inequality for matrices A, W, B, W' 

\\\{AW BW')\^)\\ - \\{AW' BW)\^)\\\ < \\{A(^ B)[W (^W' -W ^W]]"^)]], (4) 

where A and B will be sequences of Wq and W or W' are either one of the Wq or the identity. 

To describe the sequence along which we move the matrices around, let us use the shorthand notation 
Wk for Wq^. At each step we will interchange either Wk (8) Id ^ Id ^Wk or Wi Wk ^ Wk <^ Wi 
whenever they are on the right. If i > j we proceed according to the sequence 

Wn---Wi(S)ld ^Wn---W2(^Wi ^Wn---W3(g) W1W2 ^ > W„ • • • Wi+iWi Wi ■ ■ ■ Wi-i 

^Wn--- Wi+iWi-i 1^1 • • • W,.2W^ ^Wn--- Wi+iWi^iWi ^ Wi ■ ■ ■ W,^2 

^Wn--- Wi+iWi-iWi.2 1^1 • • • W^.m ^ >Wn--- Wi+iWi.i ■ ■ ■ Wj+iW^ 1^1 • • • Wj. 

Note that the last term in the sequence, when summed over a-,j j, equals Pq{aiaj\qiqj) because of Fact[T3l 
i-s- Zla^, J 11^™ • • • Wj+iWi (giWi--- Wj\^)\\'^ = \\Wi (g) Wj-|^')p = pqiaittjlqiqj). Now we can write a 
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telescopic sum according to this sequence as 

\Pclass{aiaj\qiqj) - pq{aiaj\qiqj)\ = ^ I ^ • • • W^i Id l^-)!!^ - ^ \\Wn ■ ■ ■ W2 ^ Wi\^) 



ai ,aj 



j,1 .u,j a.—,i^j 



+ Yl \\Wn---W2^Wi\^)f - J2 \\Wn---W3(S)WiW2\'^)f + ■■ 

< E 1 11^" ■ ■ ■ ^1 ® I*) 11^ " 11^" ■ ■ ■ ^2 ® W^il^) f| + 5Z I • • • I + • • • , 

a a 

where we used the triangle inequality. Using ja^ — ft^j = |a — 6| • |a + 6|, and the triangle inequality as in 
dUl, the first term is bounded by 

^ II • • • W2[Wi Id - Id ®PFl]|*)|| • (lll^n • • • 1^1 Id |^')|| + II W„ • • • W2 I^l|^')||) 



- ^Ell^"""^2[Wl^Id - Id <E)Wi]\^)P^Y(\\^n---Wi^ld 1^)11 + ||iyn---W2® Wl|*>||)^ 

where we used Cauchy-Schwarz for the inequality. We obtain similar expressions for all other terms. We 
can bound the second square root by V2 + 2 = 2, using (a + 6)^ < 20^ + 26^ and Fact [13] Assembling all 
the terms, and using Fact[T3]to eliminate all the matrices to the left of the square brackets, we obtain 

i-i . 

) - Pq{aiajhqj)\ < 2 /X] lll^i' ® M - H 0Wi>]\^) P 

ai,a, i'=l V a-/ 



+ 2(|i -il + I) Yl II - ® Id]|^')||^ 



+ 2^ YWiWi^Wi^ -W,^^ Willow. (5) 
i'=j+i y "i.^i/ 

For j > i we obtain exactly the same sequence and the same bounds in Eq. © with i and j interchanged. 
The only difference is that now the last term in the sequence, when summed over a^ij gives ||PFj(8'iyj|^') Ip, 
so we need to use symmetry of l^') to conclude that this equals to || Wj Wj|^) |p. For i = j we follow the 
sequence until Wn ■ ■ ■ Wi+iWi ® Wi ■ ■ ■ Wi^i and then use Wi = Wf to continue as Wn ■ ■ ■ Wi+iWiWi ® 
Wi ■ ■ ■ Wj-i Wn • • • Wi Wi ■ ■ ■ Wi-iWi, so we just get the first term in Eq. but summed until i. 

Now A{pciass,Pq) is boundcd by the average over (gj, qj) picked according to the distribution vr of the 
sum of the three terms appearing in (|5]l. We show how to bound each of them. For the first term 

IQI i I 

2 Y ^i^^'ii) E JE ii«;' ® Id -Id ®w^::)\^w 

i,j=l i'=l y a^, 

IQI i , 



2E^('?^) E JE ii«;' ® Id -Id ®<;)i^) 

i=l i'=l y a^/ 

IQI IQI , 



< 2 E E ^(«^' ) / E II ® Id - Id ) I ^) 

i=l i'=l y v 

IQI 

|2\l/2 

i'=l a-, 



< 2|Q|(^7rfe,)Ell«/ ®Id -Id ®</)|^)f )^/' < 2\Q\V9^, 
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where the first equahty uses the fact that the inner sum does not depend on j, the second inequality uses 
vr((7i) < 7r(gj'), the third inequality uses the fact that the square of the expectation is not greater than the 
expectation of the square, and the last inequality uses Eq. (l3bl) . The second term can be bounded in a similar 
fashion 

IQI I 

2 7rfe,g,)(K - Jl + 1) /E IKid - ® Id)l^)P 

i,j=i y oi 

IQI I 

< 2\Q\Y7r{qi) ||(Id W,"/ - Id)|^)P < 2\Q\V9^. 

1=1 y ai 

Finally the last term, using again that the inner sum does not depend on j, that the square of the expectation 
is bounded by the expectation of the square and Cauchy-Schwarz for the sum over i', can be bounded by 

IQI i-i I 

i=l i'=l y aijOj/ 

.1*31 , / \2\l/2 

<2(E^('/o(E JE ii«/®<;'-<;'®</)i^)f ) ) 

i=l i'=l y ai.fli/ 

IQI i-l ^rt 

< 2viQi (E^(90 E E iK^.? ® - ® %?)i*)ii') • (6) 

i=l i'=lai,a^i 

We decompose the sum inside the square root in the last line of (O into two parts with 7r(gj) > l/h and 
7r((7j) < l/h (with /i to be determined later). If 7r(gj) > l/h, then 7r(gi') > l//i for < i so 1 < h'K{qi'). 
Therefore, using (l3ab . the term in parenthesis in Q is bounded by 

i-l 

E E h^i<I^'MQ^) E ii(^.? ® </ - </ ® ^.?)i^)ii' 

i:iT{qi)>l/hi'=l a.i,ai, 

+ 1 E EE IKK; ® - ® K/)i^)ii' < 24/.^ + 4|Qiv/i, 

i:Tr(qi)<l/h i' = l aiAii 

where we have bounded the first part using (l3ab and the second part, using triangle inequality and Fact [13] 

E IKK: ® - ® < E (ikk; ® Kni*)ii + ii«; ® K:)\n\f < 4. 

The optimal /i is \Q\/\/6e, which gives a bound of 4 • 24^/^|(5|e^''^ for the third (dominant) term in 
A{pciass,Pq) (after taking the square root). Hence A{pciass,Pq) < 70\Q\e'^/^. □ 

4 Hardness of three-prover entangled classical games 

In this section we prove Theorem[T]for three-prover entangled classical games, which we now state as: 

Theorem 16. There is a constant S3 > such that it is NF-hard to decide, given an entangled three-prover 
classical game with a constant number of answers, whether its value is 1 or less than 1 — efor e = 
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As in the case of quantum games, we will prove this by a reduction from the PCP Theorem. This time, 
however, we will essentially preserve the number of answers in the modified game. 

We begin by describing how to modify any two-prover classical game G(2, vr, V) (which is assumed to 
be symmetric per Lemma |4]| to a three-pro ver classical game G' of equal or higher value. 

The modified three-prover game. In the constructed game G' the verifier chooses one of the provers 
uniformly at random. Rename the chosen prover Alice and call the other provers Bob and Cleve. The 
verifier samples questions q and q' according to 7:{q,q'). He sends question q to Alice, and question q' to 
both Bob and Cleve. He receives answers a, a', and a", respectively, and accepts iff the following are both 
true: 

Classical Test: The answers of AUce and Bob would win the game G, i.e., V{aa'\qq') = 1. 
Consistency: Bob and Cleve give the same answer, i.e., a' = a". 

Remarks: Note that unlike the quantum case, the verifier performs both tests at the same time. The 
consistency test plays the role of the SWAP test, limiting the advantage gained by sharing entanglement. 

Again it is clear that the value of the constructed game is at least as large as the value of the original game 
G: if the provers reply according to an optimal classical strategy (which can be assumed to be symmetric per 
Lemma nil they always pass the consistency-test. Also, it is clear in this case that the size of the description 
of the constructed game is linearly related to the size of the description of the original game, hence we have 
the same complexity parameter. 

To prove Theorem [161 we need to show the following. 

Lemma 17. Ifuj*{G') > 1- e then lo{G) > s. 

Proof. Consider a quantum strategy for G' that succeeds with probability 1 — e0 Since the game G' is 
symmetric, we can assume that this strategy is symmetric, per Lemma [5] Suppose that the provers share 
a symmetric state \^!) G H®^. Let p^^ = ii-n^ |^)(^| be the reduced density matrix of |^)(^'| on Ahce 
and Bob. When asked question qi, each prover measures their part of 1^*). Following standard arguments 
(extending the private space of the provers) we can assume that this measurement is projective. Let W^^ be 
the projector corresponding to question qi and answer Oj. This defines the quantum strategy for G'; it passes 
the classical test with probability 

vri = ^ ■n{q,q)V{aa\qq)pq{aa'\qq), 

aa'qq' 

where 

Pq{aa'\qq') = tr {w^ ® W^', p^^^ = {^W^ W^', Id |^). (7) 

It passes the consistency test with probabihty tt2 = 7r(g)vr2(g), where 7r(g) is the marginal of 7r(g, q') 
and 

7r2(g) = X] ® W^P^^) = ® Id 1^), (8) 

a a 

where we made use of the symmetry. Note that tti , 7r2 > 1 — e. 

Eqs. ^ and ^ clarify the role of the third prover, Cleve. His main purpose is not to allow the two tests 
to be performed at the same time: Indeed, it is possible to modify the protocol so that the verifier chooses two 

'^Again, as in Section [T2l we in fact consider a strategy with finite entanglement that has success probability 1 — e — 5 for some 
5 = 0(e), which we will not write. 
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of the provers at random (say Alice and Bob) and only sends questions to them, not interacting with the third 
prover at allllZl Cleve's presence would not be important if the provers were executing a classical strategy, 
but it can (and does) make a difference if their strategy requires entanglement. Indeed, if there were only two 
provers, then they could share any state p^^, whereas here we require that p^^ be extendable, i.e., it must be 
the reduced density matrix of a symmetric tripartite state. To give a concrete example, it is not possible for 
p^^ to be the maximally entangled state This is termed monogamy of entanglement IIWer89l . 

Rounding to a classical strategy: We construct a classical strategy for G from the quantum strategy for 
G' in a similar fashion as in the case of quantum games, with 

D{ai, ...,an,a'„...,a'J = \\W^: ■ ■ ■ W^^ W< ■ ■ ■ ^ld\^) f . (9) 

where gi, . . . , g„ is an ordering of the questions in Q such that 7r(gi) > 7T{q2) > • • • > 7r(g„)0 As before, 
we define Pciass{(ii,o.'j\Qi: Qj) to be the marginal of D on Oj, a'j. The structure of our proof that this strategy 
is a good one is very similar to the quantum case. The details, however, are a little different. 

Lemma 18. The (weighted) statistical distance between Pdass and pq is 

A{pciass,Pq) = '^'^{q,q)'^\Pdassia,a\q,q) -pq{a,a\q,q)\ < 12\Q\^/e. 

q,q' a, a' 

We first show how this Lemma proves Lemma [T7] Since the strategy in the entangled game passes 
the classical test with probability at least 1 — e, the classical strategy succeeds in the original game with 
probability at least 1 — e — A>1 — e — 12|(5|\/e'. For e = for sufficiently small constant S3, this 
probability is larger than s. □ 

This Lemma is the corresponding version of Lemma [151 Why is it true? Rather than showing that the 
order of measurements is not important as we did in the quantum case (although it will turn out in hindsight 
that this is true), we show that each measurement does not disturb p^^ very much. The key observation is 
as follows. Assume the provers pass the consistency test with high probability. If a particular measurement 
result occurs with certainty, the quantum state cannot be changed by the measurement. We use this fact 
in the following way: suppose Cleve were to perform the measurement corresponding to question q and 
assume he obtains an outcome a. Then, if Bob is asked question q, he must also give answer a with high 
probability. So his measurement does not change the quantum state much. But, since quantum theory is 
no-signalling, it cannot matter who measured first. It follows that Bob's measurement does not change p^^ 
much. Note that only the bipartite state p^^ is approximately unchanged — Bob's measurement can change 
the tri-parite state considerably. We then use a hybrid argument to show that performing all the 

measurements one after the other also leaves p^^ approximately unchanged. This part of the proof mirrors 
the proof of Lemma [T5] 

Proof of Lemma\T8\ Let Wq be the superoperator corresponding to the projective measurement q, i.e., 
Wq{a) := Yla Wq(j{Wq)'^ is the post-measurement state after performing {VF^} on state a. 

To quantify how much a measurement changes a state we use Winter's gentle measurement lemma. 

Lemma 19 (Lemma 1.4 IIWin991 ). Let pbe a state and X be a positive matrix with X < Id and < TipX. 
Then, 

p - VXp^/X < 3^/l- TrXp. 



"with probability p, he sends them different questions and performs the classical test; with probability 1 — p, he sends the same 
question and performs the consistency test — this modification does not materially change our conclusions, but it does weaken the 
bounds in Theorem [T6l 

Note that D differs slightly from Sec. 13.21 Here each prover gets a separate list of answers. This form is more convenient here. 
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The following simple corollary quantifies how much the measurement Wg Id changes p^^ : 
Claim 20. The trace distance between Wq ® Id (p^^) and //^ is bounded by 



\\Wq ® Id (/^) - p^^lll < 6^1 - ^2(9). 

Proof. Using Wg Id(pA'^) = tr7^3(Wg Id «)Id (|^)(^'|)) and p^^ = iin-Ald ®Id ®Wq{\^){^\)), 
by monotonicity of the trace distance under partial trace, 

\\Wq®ld{p^^)- p^^Wl < \\Wq®ld 0ld(|^)(^'|) - Id ®Id ®Wq{\^)m)\\l 

< \\Wq®U ®Id(|*)(^'|) -^Wg^'^Id ®W^\^){^W^®ld ®W^\\l 

a 

+ II ®W^\^){^W^®ld ®W^-ld ®ld ^Wg(|^)(^'|)||i 

a 

< 2\\J2Wq^U ®Wg"|^')(^|Wg"Old 0W^-ld^ld «)>Vg(|^')(^|)||i 

a 

< 6^/1- TT2{q), 

by the triangle inequality, symmetry, and then taking p = 0^1^^ (gi Id (gild |^')(^|iyg (g Id (gid and 
X = 0„ Id Id (g)W;^ in LemmaM □ 

For I < i,j < n, let 
Then 

Pdassiaia'Aqiq'A = tr ( (VFf; O w"/)/9(i, j) 



Hence if we can bound j)— p||i, then we can bound ^ / \pdass{aia'Aqiq'j)—pq{aia',\qiq',)\, since the 

^ ^ j 1/1/ J J 

trace distance between two states is an upper bound on the variation distance of the probability distribution 
resulting from making any measurement on those two states. 

The following technique was introduced by Ambainis, Nayak, Ta-Shma, and U. Vazirani IIANTV02II 
and has been used extensively by Aaronson IIAar051lAar06ll . 

Claim 21. The trace distance between p^^{i,j) and p^^ is bounded by 



i'=l j'=l 

Proof. Proof by induction. The claim is clearly true for (i, j) = (1, 1). Given it is true for a particular value 
of (i, j), we show it is also true for [i + 1, j). In view of the symmetry, this is sufficient to establish the 
claim. We have 

||/B(. ^ 1^^.) _ ^AB||^ < ||^AB(. ^ _ ^ (^AB)ii^ ^ ^ (^AB) _ ^AB||^ 



< II W,, Id - Z'^) 111 + 6^/1 -^2(gi) 

<||/«(i,j)-pA«||i + 6Vl-vr2(g.), 
where we used the triangle inequality. Claim [20l and monotonicity of the trace distance. □ 
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Putting everything together, it follows that 

n 

n I i-l i-l 

< 6 ^ 7r(gi, q^) ^ \/\-'K2{qi') + X] V ^ ~ ^2(9^') 

j,jr = l \v = \ j' = l 

n i—l 

< 12 5^^vr(gi)Vl-vr2(%0 

i=l i'=l 
n 

< 12\Q\ AQi')V'^-MQi') 

i'=i 

< 12\Q\^/T^7^< 12\Q\^/~e, 
since tt2 = J2q "^(9)^2(9) > 1 — e and y/l — x is concave. □ 

5 Hardness for two-prover classical entangled games 

In this section we prove our main theorem for two-prover entangled classical games. It shows that it is 
PSPACE-hard to decide, given a succinct entangled two-prover classical game, whether its value is 1 or 
less than 1 — e for e = p^iy(^^^^y To state the result, we need some further definitions to clarify the notion of 
succinctly given games and state the connection between PSPACE and multi-round single-prover games. 

Definition 22. A language L is in MIF* g(N,l) if,forallx G L, there is a polynomial time (in \x\) mapping 
from X to classical one-round games Gx{N, tTx, V^), such that it is possible to sample from tTx in polynomial 
time and compute the predicate Vx in polynomial time and 

• Completeness: for all x G L, the entangled value uj*{Gx) > c, and 

• Soundness: for all x ^ L, the entangled value uj*{Gx) < s. 

Note that in this scenario the game is given succinctly: it is given by a description of V (as a polynomial 
time circuit, for instance, which implies that \Q\, \ A\ = 2P°^y(l^l)) and a polynomial size description of tt, 
which can be sampled in polynomial time. Hence the complexity parameter here is and \Q\ and |^| are 
exponential. 

We also require the notion of single-prover games with multiple rounds. We modify Definition |3] to 
account for games with multiple rounds. Here we will only consider non-adaptive games: the probability 
distribution on questions in Q for each round k does not depend on the answers received in previous rounds, 
which is sufficient for PSPACE (see Theorem l23l). However, we allow for the possibility that the questions 
asked in each round depend on the questions asked in previous roundsl^ In other words a one-player r-round 
game G(l, vr^, Vr) is given by a joint distribution it : Q"^ ^ [0, 1], and a predicate Vr : x ^ {0, 1} 
(i.e. the verifier accepts or rejects as a function of all the answers received in all rounds). The strategy is 
now a set of r functions Wk, where the A;th function can depend on the previous questions and answers. The 
class IP(r) is given by Definition |22] when the game is a single-prover multi-round game with r rounds. We 
omit reference to r and write IP when the number of rounds is polynomial in 

"Note that this is equivalent to having a joint distribution on the questions, where we obtain the distribution on the ith question 
as the corresponding marginal. 
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Theorem 23. l[Sha92\l There is a constant sjp > such that PSPACE = IPi .jjp- Moreover there are 
"public-coin non-adaptive" W -protocols for PSPACE, i.e. such that in each round the distribution on the 
questions is independent of the answers of the prover and of other rounds [\GS89\ \She92\l . 

With these notions in place we can state our main result for two-prover classical entangled games. 

Theorem 24. PSPACE C MIP*(2, l)iA-efar e = ^o\y(\x\) ' ^^^^^ \A ^^P^t ^'^^e. 

We note that if a parallel repetition theorem could be established for classical two-prover entangled 
games, then the containment in Theorem l24l could be improved to PSPACE C MIP*(2, l)i with con- 
stant or even exponentially small s. This is a particularly interesting direction to pursue, in light of the 
perfect parallel repetition theorem for entangled XOR games of Cleve et al. [ICSUU07 I (which uses the 
SDP-description on the value of these games). 

To prove Theorem |24] we use the PSPACE-characterization in Theorem |23] and show the following. 

Lemma 25. There is a constant S2 > such that for every succinctly given single-prover r-round non- 
adaptive game G{l,TTr,Vr), of value uj{G) with questions Q and answers A, there is a two-prover one- 
round classical game Gc{2, vr, V) with questions and answers with entangled value uj*{Gc) > ^{G) 
such that if uj*(Gc) > 1 — £ then uj{G) > sip for £ = Moreover, a succinct description of Gc can 
be computed from a description of G in polynomial time, and sampling n and computing V can be done in 
polynomial time. 

Lemma |25] shows IP(r)i sjp ^ MIP(2, 1)* , S2 > and combined with Theorem [23] gives Theorem l24l 

The rest of this section is dedicated to the proof of Lemma [25] It follows the main traits of the proofs 
of the previous two hardness results. Our construction of the two-prover one-round game uses a protocol 
of IICCL94 1 used to prove that PSPACE has two-prover one-round systems. We show that this protocol 
remains sound even against entangled provers, albeit with larger soundness. To prove this we again use the 
consistency test with the extra prover to extract almost commuting conditions on the operators of the provers. 
This allows us to round in a similar fashion from a good strategy for the entangled game to a strategy for the 
single prover game which succeeds with relatively large probability. 

The modified two-prover game. In the constructed game Gc, the verifier samples a series of questions 
qi, . . . ,qr according to the distribution -Kj-iqi, ■ ■ ■ ,qr)- He picks a k uniformly at random in {1, . . . , r}, and 
sends questions (71 , 52 , • • • > 9r to Alice and qi,q2, ■ ■ ■ ,qk Bob. He receives answers a = ai, . . . ,ar from 
Alice and a' = a'l, . . . , a'^. from Bob. He accepts if and only if the following are both true: 

Classical Test The answers Alice gives would win the game G: V{ai . . . an\qi ■ ■ ■ qn) = 1- 

Consistency Test For alH in {1, . . . , A;}, Oj = a'j. 

Remark: It is again obvious that the value of the new game is lower bounded by the value of the original 
game: If both provers reply according to an optimal classical strategy, then they will always give consistent 
answers, so their acceptance probability is exactly u{G). 

It is also easy to see that the constructed game has the same complexity as the original game. The new 
verifier essentially implements the original verifier and the consistency test, which can be described in linear 
time in A^ . The sampling procedure also has the same complexity as sampling from the original vr^. And 
obviously it is possible to compute the new game from the original game in polynomial time. 

To prove Lemma[25]we need to show the following. 

Lemma 26. Ifuj*{Gc) > 1 - e then uj{G) > sjp. 
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Proof. Consider a quantum strategy for G' that succeeds with probabihty 1 — For any sequence of 
questions gi, . . . , we define to be the sequence qi, . . . ,qk. Similarly, for any sequence a = oi, . . . , 
of possible answers we will denote its prefix ai, . . . , by a^. Note that when we write and a; for some 
1 < /c, Z < r we refer to substrings of the same string a = ai, . . . , a^, whereas we will write a/c and a^ if we 
refer to different strings a and a'. 

Let l^f) be the entangled state shared by Alice and Bob and define a corresponding density matrix 

~ ~ a' 

p = Let Wq^ = {H^q^ } and Wq,, = {Wq^*'} be the measurements that they perform when asked 

questions resp. q^j giving answers a^ resp. a'^. As in Sec. |4]we can assume that these measurements are 

projective. 

The provers pass the consistency test with probability 7r2 = Ylk=i ^2(^)> where 



is the probability that the two provers give consistent answers when the verifier has picked k as the separation 
point. Conditioned on the fact that they gave consistent answers, they succeed in the classical test with 
probability vri = ^ Ylk=i ^i(^) where 



and pg{ar\qr, k) = Tr yW^^ (gi Wql;pj is the probabihty that Alice answers a^ and Bob answers consis- 
tently, given that the verifier picked index k. 

Rounding to a classical strategy: Given a strategy for the constructed entangled-prover game Gc, we 
define a strategy for the classical prover of the original game G in the following way. In round k, given the 
questions to the prover so far are q^ and the prover gave answers a^-i, he answers to question with 
probability 



Pclass 

(afc|qfe,afc- 



Tr(ld ®VFqt<t-i •••W^q^V: 



Tr(ld 0W^^:l---W^ip) 

(recall that all a^, a^-i, . . . , ai refer to substrings of the same string). Note that Pciass{o-k\qk, ^k-i) 
could be less than 1 (we will see from its operational definition that it is always bounded by 1). To complete 
it to a probability distribution we add a special symbol "abort" that the prover can send in any round making 
him lose the gamel^ 

This probability distribution has the following interpretation. For any operator A, denote A{p) = ApA^ . 
In the first round the prover in the classical game receives a question qi, and applies the measurement Wqj 
on Bob's part of p, answering ai with probability Tr (id (iSiW^^p) = Pdass(ai|qi)- He is then left with 

the state ■ Upon receiving a question q2 in the second round, he measures this state with Wqj, 

answermg 02 with probabihty — fW- — .,^b.-^\ = Pciass\0'2\q2^^i) 11 as a result of his measurement he 
obtains a sequence a2 = aia2 consistent with the ai he had measured in the first round, and an abort 



Again, as in Section [T2l we in fact consider a strategy with finite entanglement that has success probability 1 — e — 5 for some 
S = 0{e), which we will not write. 

^'Technically speaking the extra symbol makes it a different game. We could also have the prover send a random answer 
whenever sampling from the complement of the distribution. This can at most increase the prover's winning probability, so both 
games have winning probability bounded by ui. 
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symbol in case the sequence he measures has an a'l ^ ai. The resulting state in case of non-abortion is 

/ i^'^^lT^.^lw-. ^ = 1^t!SS^\ - The prover proceeds similarly at the subsequent rounds. 

In other words the prover sequentially performs all the measurements Wq^,, and answers according to the 
resulting distribution, aborting in case the answers he measures in round k contradict the answers that he 
has already given in previous rounds. 

What is the probability that a fixed sequence of answers is given by the prover? We have that 

Pdass{^r\^.T) = Pciass{arHr, Sir^i) Pdass (^2 |q2 , «i ) • Pdass(ai |qi). Bccausc of Cancellation, we 

obtain 

Pclass{Sir\^.r) = Tr (id • • • W^lp) . 

We will show that this classical strategy is a good one by relating Pclass{^r\^.r) to pg(ar|qr , r) as per 
the following lemma. 

Lemma 27. The ( weighted) statistical distance between Pdass cind pg is 



A{pclass,Pq) = Ed 



E 



Pda 



(ar|qr) -pg(ar.|q.r,r) 



< 7r^/e. 



This lemma is the analogue of Lemmas [T5] and [181 and its proof is very similar. Before proceeding to 
its proof, we first show how it implies Lemma [26l For the total acceptance probability of the entangled 
provers we have I — e < 1/r ^^^^ min(7ri(fc), 7r2(A;)) because for any index k that is picked by the 
verifier, we require the provers to succeed in both the Classical Test and the Consistency Test. This implies 
that 7ri(r) > I — re, so Bob's answers can be used to give correct answers to the Classical Test with 
probability at least 1 — re, and by Lemma |27] this implies that the Classical Test has success probability at 
least I — re — 7ry^. For e = -^l for a sufficiently small constant S2 this is more than sjp, which implies 
Lemma l26l □ 



Proof of Lemma\27\ As in the case of three-prover classical entangled games, the fact that Alice's and Bob's 
answers must be consistent means that Alice's answers can be used to predict Bob's, so Bob cannot use his 
share of the entanglement too much if they are to succeed in the Consistency Test. This means that the action 
of Bob's operators W on the entangled state p is close to the identity, at least when the first prover applies 
the corresponding VV on his share of p. The following Claim makes this explicit and will be used to relate 
the classical and quantum strategies. 



Claim 28. Let the projector V^^^ = 



The following hold for every k € {1, . . . , r}: 



E, 



qr 



E^ 



E, 



Qr 



||ld - Kr ® W^'JP) 

a*: 

^ \\v^^>' Id (p) - w^;:ip) 

afc 



< 3^/l-^T2ik), 



< 3Vl-7r2(fc), 
< l-vr2(A;). 



afc 



(10) 

(11) 

(12) 



Proof. Eqs. (ITOl ) and (fTTl) are a direct application of Lemma[T9l combined with the definition of 7r2(A;). To 
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prove Eq. note that since V^^^'^ W^^ (p) > V^J' Wq^{p), we have that 



qr 



^ Tr{w^r'''-''^^w^;:p). 



Since Ea.,^ Tr(W^-; = 1, 



which concludes the proof. 



^ Tr{W^^<S)W^^p) 



□ 



Observe that for any set of orthogonal projectors we have that J2a WW^-aiW"" — W'^a2W'^\\i < 

Wo'i — C2II1 for any two matrices ui, (72. Using this successively for the sets {W^^}a2, {W^^}ar, from 
Eq. ([Tol l with = 1 we get 



E. 



Qr 



Similarly, from Eq. (fTTI ). 



qr 



W^q,^ (P) - C ® W^q; • • • (p) 



< 3^/l-^T2il). 



<3^/l-^T2il) 



and from Eq. (fT2]) with A; = 2 



E ll^q.' ® ^q; • • • K2(P) - Kr ® ■ ■ ■ ^q2 (P) 



< l-vr2(2) 



Repeating these operations for each k, adding the equations and using triangle inequality finally yields 



E, 



qr 



E ||id ^w^: • • • w^iip) - vi^ w^:{p) 



< 6 E Vf-Mk) + E(l - Mk)) 

k=l k=2 

< 7r\/l — 7r2 



using concavity of the function \/l — x. Since F,^^'' = W^^r, the lemma follows because the trace dis- 
tance is an upper bound on the variation distance of the probability distribution resulting from making any 
measurement on these two states. □ 



6 Conclusions and Open Questions 

We have established that it is NP-hard to approximate the value of both two-prover quantum entangled 
games and three-prover classical entangled games. These results leave open the case of fwo-prover one- 
round classical entangled games. Can our techniques be extended to this case? 

The other obvious question is whether we can improve the inapproximability ratio to better than an 
inverse polynomial in the number of questions. Are there additional tests that further limit the advantage 
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provers can obtain by sharing entanglement? For example, in the case of classical entangled games, does it 
help to add more than three provers? In particular, if there are as many provers as there are questions, then 
sharing entanglement does not help, even if the verifier only talks to two provers chosen at random. 

In very recent work IIKKMV07I a subset of the authors obtain parallelization results for the case of 
quantum multi-round entangled games, showing that any such game with k provers and r rounds can be 
parallelized to a 3-tum game with k provers at the expense of a poly(r) factor in the value of the game. 
Moreover, such a game can be parallelized to 2 messages, or 1 round, by adding a (A; + l)-st prover. We do 
not know whether it is possible to parallelize quantum entangled games from three to two messages without 
adding an additional prover. 

There are a number of other important questions that our work does not address. Can we prove upper 
bounds on the hardness of computing the value of entangled games? It is instructive here to compare to 
the case where the provers share no-signalling correlations, where there is an efficient linear-programming 
algorithm to compute the value of a game BPrelll^ In the quantum case, it is still not known whether the 
decision problem corresponding to finding the value of an entangled-pro ver game is recursive! The issue is 
that we are not currently able to prove any bounds on the amount of entanglement required to play a game 
optimally, even approximately. 
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